SIEMLite wiki

SIEMLite is a lightweight, embedded SIEM in a single Go binary. It collects logs over HTTPS or syslog, normalizes them to the OCSF event model, stores them in SQLite (one file per day) and gives you full-text search through a built-in web UI and a small JSON API.

This wiki is the full documentation. The README has the short version. Current release: latest.

Start here

• Installation: run the binary or Docker, first sign-in, upgrading from older versions.
• The web UI: a tour of every page.
• Sending logs: apps over HTTPS, syslog devices, and the command line.
• Run on the internet: a trusted Let's Encrypt certificate for your domain, built in.

Using SIEMLite

• Sources and tokens: who is sending, and how to disable or delete them.
• Parsers: teach SIEMLite how to read a source's lines, with optional AI help on this server or in the cloud (AI Parsers).
• Search: query syntax and what is searchable.
• Alerts and the Audit log.
• GeoIP and ASN and Threat intel: event enrichment.
• Users and security.
• Integrations: the services SIEMLite connects to.
• AI agents (MCP): let Claude Code, the Gemini CLI, OpenCode and other AI agents search logs and manage alerts, sources and parsers.
• Security audit: checks SIEMLite and the server it runs on, with the fix for each finding.
• Sign in with Microsoft: let an Entra group sign in with their work accounts.
• Email: the mail server SIEMLite sends through.
• Backups and updates.
• Test logs (loggen): realistic sample logs, attacks included.

Reference

• Configuration: every flag and environment variable.
• API reference
• Troubleshooting
• Architecture, Performance and Development

License

AGPL-3.0. See the license.